This vulnerability involves a CSRF issue in the 'All push notification for WP' plugin, which also allows reflected XSS attacks. The affected versions are all versions up to 1.5.3. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No official patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of an authenticated user via CSRF, combined with reflected XSS, potentially leading to limited data disclosure, modification, or disruption of service. The CVSS score of 7.1 reflects a high severity impact affecting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or applying any available temporary mitigations recommended by the vendor. Monitor official sources for updates.